CVE-2025-13926

CRITICAL 9.8

Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision

CVSS Score

9.8

EPSS Score

0.1%

EPSS Percentile

22th

An attacker could use data obtained by sniffing the network traffic to forge packets in order to make arbitrary requests to Contemporary Controls BASC 20T.

CWE	CWE-807
Vendor	contemporary controls
Product	bascontrol20
Published	Apr 9, 2026
Last Updated	Apr 10, 2026

Stay Ahead of the Next One

Get instant alerts for contemporary controls bascontrol20

Be the first to know when new critical vulnerabilities affecting contemporary controls bascontrol20 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Contemporary Controls / BASControl20

3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ccontrols.com: https://www.ccontrols.com/support/contacttech.htm cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-099-01 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-099-01.json

Credits

Joseph Fields of Naval Information Warfare Center Pacific reported this vulnerability to CISA.